@noob-stupid/dsh-plugin-console 0.5.71 → 0.5.77

package/lib/client.js

@@ -280,6 +280,11 @@ window.__ModuleLoader__.load({
 			migrateBtn: "迁移并适配",
 			aiEmpowerFrameworkCheck: "框架适配检测",
 			userForcedTag: "补丁强制启用",
+			// ★ 0.5.76（用户 2026-10-18）：禁用**出处**要写明，别只给一句"已停用"
+			disabledByBundleTag: "插件默认禁用",
+			forcedNotLoadedTag: "强制启用未生效",
+			revokeForceLabel: "撤销该强制启用",
+			revokeForceHint: "这条 disabled: false 覆盖没有让插件加载起来 —— 撤掉它，界面不再显示「强制启用」的假象（不会改动清单）",
 			protectedTag: "受保护",
 			unobserved: "未挂载",
 			pending: "等待依赖",
@@ -891,6 +896,10 @@ window.__ModuleLoader__.load({
 			migrateBtn: "Migrate & adapt",
 			aiEmpowerFrameworkCheck: "Framework compat check",
 			userForcedTag: "Forced on by patch",
+			disabledByBundleTag: "Disabled by plugin default",
+			forcedNotLoadedTag: "Force-enable had no effect",
+			revokeForceLabel: "Revoke this force-enable",
+			revokeForceHint: "This disabled: false override did not make the plugin load; revoking it stops the false forced-on badge (the manifest is untouched)",
 			protectedTag: "Protected",
 			unobserved: "Not mounted",
 			pending: "Waiting for dependencies",
@@ -2306,7 +2315,14 @@ function healthSignature(health) {
 			const [toolbarPos, setToolbarPos] = react.useState(() => {
 				try {
 					const v = JSON.parse(localStorage.getItem("pc-toolbar-pos") || "null");
-					if (v && Number.isFinite(v.left) && Number.isFinite(v.top)) return { left: v.left, top: v.top };
+					if (v && Number.isFinite(v.left) && Number.isFinite(v.top)) {
+						// ★ 用户 2026-10-18：存下来的位置**必须钳进可视区**，否则拖到标题栏/屏幕外就再也拿不回来。
+						//   上边界 64px 是标题栏与窗口按钮的安全区（原来只钳到 8px，正好落在标题栏里）。
+						const SAFE_TOP = 64;
+						const maxLeft = Math.max(8, (window.innerWidth || 1280) - 120);
+						const maxTop = Math.max(SAFE_TOP, (window.innerHeight || 800) - 80);
+						return { left: Math.min(Math.max(8, v.left), maxLeft), top: Math.min(Math.max(SAFE_TOP, v.top), maxTop) };
+					}
 				} catch {}
 				return null;
 			});
@@ -2929,6 +2945,15 @@ function healthSignature(health) {
 					(error) => setDetails({ entryId: entry.entryId, status: "error", error }),
 				);
 			};
+			// ★ 0.5.76：撤销"强制启用"覆盖（补丁里的 disabled: false）。只对确实 forced 的行生效，服务端会校验。
+			const revokeForce = (entry) => {
+				if (busy !== null) return;
+				setBusy(entry.entryId);
+				call("/plugin-console/revoke-force", { entryId: entry.entryId }).then(
+					(data) => { setMessage(data?.note ?? t("revokeForceLabel")); refresh(); },
+					(error) => { setMessage(friendlyGithubError(error).message); },
+				).finally(() => setBusy(null));
+			};
 			const checkUpdate = (entry) => {
 				const pkgName = entry.moduleName;
 				setUpdateCheck({ status: "checking" });
@@ -4135,6 +4160,10 @@ function healthSignature(health) {
 							entry.protected ? el("span", { className: styles.tag, "data-user": "true" }, t("protectedTag")) : null,
 							entry.userDisabled ? el("span", { className: styles.tag, "data-user": "true" }, t("userDisabledTag")) : null,
 							entry.userForced ? el("span", { className: styles.tag, "data-user": "true" }, t("userForcedTag")) : null,
+							// ★ 0.5.76：被**别处**（插件自身补丁/框架默认）禁用的行 —— 这就是"补丁强制启用"的来由
+							entry.disableSource === "bundle" ? el("span", { className: styles.tag, "data-user": "true", "data-source": "bundle" }, t("disabledByBundleTag")) : null,
+							// ★ 0.5.76：补丁写了强制开启、运行时却仍没起来 ⇒ 这条覆盖是**无效的**，必须说出来
+							entry.forcedNotLoaded === true ? el("span", { className: styles.tag, "data-user": "true", "data-source": "ineffective" }, t("forcedNotLoadedTag")) : null,
 						),
 						el("div", { className: styles.meta },
 							el("span", { className: styles.phase, "data-phase": entry.fiberPhase ?? "unobserved" },
@@ -4164,11 +4193,18 @@ function healthSignature(health) {
 								el("button", {
 									type: "button",
 									className: styles.toggle,
-									disabled: !entry.toggleable || busy === entry.entryId || entry.pendingCompat === true,
+									disabled: !entry.toggleable || busy === entry.entryId, // ★ 待适配不再禁用启用（用户 2026-10-18）：启用=确认启用，服务端会把它标为已采纳
 									// 0.5.34：结论已被当前判据撤回的行不再显示「待适配」（旧判据的误报不许当事实展示）
 									title: entry.pendingCompat === true ? (entry.compatRescinded === true ? t("compatRescindedHint") : t("pendingCompatHint")) : undefined,
 									onClick: () => toggle(entry, !entry.enabled),
 								}, busy === entry.entryId ? t("loadingPhase") : (entry.pendingCompat === true ? (entry.compatRescinded === true ? t("compatRescindedTag") : t("pendingCompatTag")) : t(entry.enabled ? "off" : "on"))),
+								// ★ 0.5.76：补丁写了强制开启但运行时没起来 ⇒ 给一个撤销覆盖的入口
+								entry.forcedNotLoaded === true ? el("button", {
+									type: "button",
+									className: styles.toggle,
+									title: t("revokeForceHint"),
+									onClick: () => revokeForce(entry),
+								}, t("revokeForceLabel")) : null,
 								el("button", {
 									type: "button",
 									className: styles.toggle,
@@ -4922,9 +4958,7 @@ function healthSignature(health) {
 								el("p", { className: styles.message }, t("compatGateHint")),
 								el("p", { className: styles.status, "data-pending": gatePendingCount > 0 ? "true" : undefined },
 									gatePendingCount > 0 ? t("gatePendingInfo").replace("{n}", String(gatePendingCount)) : t("gatePendingNone")),
-												el("p", { className: styles.status, "data-pending": gatePendingCount > 0 ? "true" : undefined },
-								gatePendingCount > 0 ? t("gatePendingInfo").replace("{n}", String(gatePendingCount)) : t("gatePendingNone")),
-							// 明细清单（2026-09-24 用户要求：面板要能看到是哪些插件，有列表数据）
+																			// 明细清单（2026-09-24 用户要求：面板要能看到是哪些插件，有列表数据）
 							gateRows !== null && gateRows.pendingCount + gateRows.adoptedCount > 0
 								? el("div", { style: { flexDirection: "column", gap: 6, display: "flex" } },
 									el("strong", { className: styles.name }, t("gateListPending").replace("{n}", String(gateRows.pendingCount))),
@@ -5339,7 +5373,7 @@ function healthSignature(health) {
 						const bw = e.currentTarget.offsetWidth || 96;
 						const bh = e.currentTarget.offsetHeight || 30;
 						const left = Math.max(8, Math.min(w - bw - 8, e.clientX - dragRef.current.grabX));
-						const top = Math.max(8, Math.min(h - bh - 8, e.clientY - dragRef.current.grabY));
+						const top = Math.max(64, Math.min(h - bh - 8, e.clientY - dragRef.current.grabY)); // ★ 64 = 标题栏安全区
 						setDragPos({ left, top });
 					},
 					onPointerUp: () => {

package/lib/server/domain/manifest.js

@@ -226,7 +226,21 @@ async function declareProfileDependency(profileDir, packageName, version = null,
     sourceInstall = await installSourceDependency({ profileDir, spec: installSpec, registries, install: installSource })
     recordSourceSpec({ packageName, spec: installSpec, kind: sourceKind, install: sourceInstall, ...homeOpt })
     if (sourceInstall.ok !== true) {
-      plan = await planDependencySpec({ profileDir, packageName, version: resolved, registries, probe, home, profile, sourceSpec: null })
+      // ★ 0.5.72（用户 2026-10-18 批准）：**不再回落成 link:**。
+      //   有真实来源规格却装不上 ⇒ 如实报错、**不写清单、不建 link**；
+      //   偷偷挂一份本地副本会让人以为"装上了"，而依赖与 peer 其实没有被包管理器保证过。
+      //   仍保留「一键真装」动作：给的是"重试真实通道"的出路，不是假装成功。
+      const why = typeof sourceInstall.error === 'string' && sourceInstall.error !== '' ? sourceInstall.error : '（原因未记录）'
+      return {
+        ...empty,
+        version: resolved,
+        form: plan.form,
+        reason: `真装失败：${why}`,
+        sourceInstall,
+        depNote: `${packageName}：已获取源码但**真装失败**（${why}）—— 未改动清单，也未按 link: 记录。` +
+          `可点「一键真装」重试；或改用「从本地目录安装」显式走开发式链接。`,
+        suggested: suggestedRealInstallAction({ packageName, spec: installSpec, profile, profileDir }),
+      }
     }
   }
   const installNote = composeSourceInstallNote({ packageName, install: sourceInstall, plan })

package/lib/server/domain/update-candidates.js

@@ -60,13 +60,33 @@ function dropStaleUpdateCandidates(candidates, packageName, baseUrl, profileDir)
  * @param {{ latest?: string|null, next?: string|null, beta?: string|null }} candidates
  * @returns {string|null} 目标版本；全空 ⇒ null（真的没有更高版本）
  */
-function pickUpdateTarget(candidates) {
+/**
+ * 从 { latest, next, beta } 里选出**该更新的目标版本**。
+ * ★ 0.5.74（用户 2026-10-18）：按**版本高低**选，不再按通道顺序取第一个非空。
+ *   真机证据：官方包只往 next 发版而 latest 停在远古 alpha ——
+ *     dsh-experimental-speech-to-text: latest 0.1.7-alpha.1 / next 0.2.1-rc.2
+ *   旧实现返回 latest ⇒ 界面永远"已是最新版"，next 里的新版永远看不见。
+ *   比较**不做第二份实现**：共用 infra/semver.js#pickNewerSemver（本模块既有的唯一判据）。
+ *
+ * @param {{latest?:string,next?:string,beta?:string}} candidates
+ * @param {{installedVersion?:string|null}} [options] 给了就优先选**严格高于它**的；没有更高的则退回全体最高
+ */
+function pickUpdateTarget(candidates, options = {}) {
   const src = candidates !== null && typeof candidates === 'object' ? candidates : {}
-  for (const key of ['latest', 'next', 'beta']) {
-    const value = src[key]
-    if (typeof value === 'string' && value !== '') return value
+  const list = ['latest', 'next', 'beta']
+    .map((key) => src[key])
+    .filter((value) => typeof value === 'string' && value !== '')
+  if (list.length === 0) return null
+  const installed = typeof options?.installedVersion === 'string' && options.installedVersion !== ''
+    ? options.installedVersion
+    : null
+  // ① 有已装版本：取严格高于它的最高者
+  if (installed !== null) {
+    const newer = pickNewerSemver(installed, list)
+    if (newer !== null) return newer
   }
-  return null
+  // ② 没有更高的（或根本没给已装版本）：取全体最高的 —— 以 0.0.0 为基准即可（唯一判据仍是同一个函数）
+  return pickNewerSemver('0.0.0', list)
 }
 
 export { dropStaleUpdateCandidates, installedVersionOf, pickUpdateTarget }

package/lib/server/routes/index.js

@@ -27,6 +27,7 @@ import { routeGithubLogin, routeGithubOpenLogin } from './github-login.js'
 import { routeInstall, routeInstallStatus } from './install.js'
 import { routeLockfileCheck, routeLockfileRepair } from './lockfile.js'
 import { routeEnrich, routeMarketIndex, routeRepo, routeSearch, routeSubpackages } from './market.js'
+import { routeRevokeForce } from './revoke-force.js'
 import { routeAdaptUnlock, routeAdaptUnlockAll, routeCleanResiduals, routeSelfUpdate, routeToggle, routeUninstall } from './plugins.js'
 import { routeSkillRemove, routeSkillToggle, routeSkillsInstalledGet } from './skills.js'
 import { routeGiteeOauthCallbackGet, routeGiteeOauthUrlGet, routeRegistryScan, routeSources, routeSourcesGet } from './sources.js'
@@ -130,6 +131,7 @@ const ROUTES = [
   { methods: ['POST'], path: `${ROUTE_PREFIX}/toggle`, handler: routeToggle },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/uninstall`, handler: routeUninstall },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/adapt-unlock`, handler: routeAdaptUnlock },
+  { methods: ['POST'], path: `${ROUTE_PREFIX}/revoke-force`, handler: routeRevokeForce },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/adapt-unlock-all`, handler: routeAdaptUnlockAll },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/clean-residuals`, handler: routeCleanResiduals },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/self-update`, handler: routeSelfUpdate },

package/lib/server/routes/revoke-force.js

@@ -0,0 +1,35 @@
+// L2 · routes —— 撤销「无效的强制启用覆盖」（0.5.76，用户 2026-10-18）
+//
+// 场景：补丁里写了 `disabled: false`（强制开启），但该行运行时根本没加载、也不是 peer 否决造成的
+//   —— 这条覆盖是**死的**，留着只会让界面继续显示「强制启用未生效」而毫无作用。
+//
+// 语义（写死）：
+//   · 只对**确实在 forced 列表**里的行生效 —— 不凭空改别人的补丁；
+//   · 复用 patch.js#removeDisableBlock（与 adapt-unlock 同一实现，不写第二份）；
+//   · 移除后**不承诺"已启用"**：撤掉覆盖只代表不再强压，实际是否加载由框架决定。
+import { existsSync } from 'node:fs'
+import { findPatchPath } from '../infra/paths.js'
+import { removeDisableBlock, readPatchState } from '../domain/patch.js'
+import { sendError, sendJson } from '../infra/httpd.js'
+
+async function routeRevokeForce(req, res, rc) {
+  const body = rc.body !== null && typeof rc.body === 'object' ? rc.body : {}
+  const entryId = typeof body.entryId === 'string' ? body.entryId : ''
+  if (entryId === '') { sendError(res, 400, '缺少 entryId'); return }
+  const rowId = entryId.includes(':') ? entryId.split(':').slice(1).join(':') : entryId
+  let patchPath = null
+  try { patchPath = findPatchPath(rc.ctx) } catch { patchPath = null }
+  if (typeof patchPath !== 'string' || patchPath === '' || !existsSync(patchPath)) {
+    sendError(res, 400, '当前 profile 没有可写的补丁文件'); return
+  }
+  let forced = []
+  try { const state = await readPatchState(patchPath); forced = Array.isArray(state?.forced) ? state.forced : [] } catch { forced = [] }
+  if (!forced.includes(rowId)) {
+    sendError(res, 400, `${rowId} 当前不是「补丁强制启用」状态（没有 disabled: false 覆盖块），无需撤销`); return
+  }
+  try { await removeDisableBlock(patchPath, rowId) }
+  catch (error) { sendError(res, 500, `撤销失败：${error instanceof Error ? error.message : String(error)}`); return }
+  sendJson(res, 200, { ok: true, rowId, revoked: true, note: `已移除 ${rowId} 的强制启用覆盖（disabled: false）。该行是否加载由框架决定，本次未改清单。` })
+}
+
+export { routeRevokeForce }

package/lib/server/routes/state.js

@@ -98,7 +98,7 @@ async function routeStateGet(req, res, rc) {
         repository: meta?.repository ?? null,
         // v0.3.45：只有"补丁里此刻确实还禁着它"的行才显示【待适配】——
         // 记录与开关脱节时（用户手动启用过 / 补丁块被清掉）不能继续挂着「待适配」误导人
-        pendingCompat: compatPendingRows.has(entry.rowId) && disabledByPatch,
+        pendingCompat: (compatPendingRows.has(entry.rowId) && disabledByPatch) || veto !== null,
         // 0.5.34 加法：记录的 `fail` 若已被**当前判据**撤回（旧误报），面板据此不再说「待适配」，
         // 改说「判据已撤回·可解锁」并给一键解锁入口（判据本身一个字都没放宽：真 fail 仍 fail）
         compatRescinded: compatPendingRows.has(entry.rowId) && verdict?.rescinded === true,
@@ -109,6 +109,14 @@ async function routeStateGet(req, res, rc) {
         adoptable: adoptable.get(entry.rowId) ?? null,
         // 框架 peer 预检的本地复算结果（null = 无话可说；只在这类行上下发，不新增常驻面板行）
         veto,
+        // ★ 0.5.76（用户 2026-10-18）：**禁用出处** + 无效强制覆盖的可见性（只加字段，不改既有判定）
+        //   'patch'  = 本控制台补丁禁的（删块即可正常启用）
+        //   'bundle' = 插件自身/框架默认禁的（我们只能写 disabled:false 覆盖 ⇒ 补丁强制启用）
+        disableSource: !entry.enabled && entry.fiberPhase === null
+          ? (disabledByPatch ? 'patch' : 'bundle')
+          : null,
+        // 强制开启写了、但运行时仍没起来，且不是 peer 否决造成的 ⇒ 这条覆盖是**无效的**，要说出来
+        forcedNotLoaded: patch.forced.includes(entry.rowId) && entry.enabled !== true && veto === null,
       }
     })
     const compat = await detectCompat(ctx.baseUrl ?? 'file:///')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.5.71",
+  "version": "0.5.77",
   "description": "DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirrors or a local file:// repo for intranet-only, offline installs.",
   "repository": {
     "type": "git",